Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
9

Quick guess: You've upgraded the OS and the system has been up for a very long time, or managed to upgrade it without replacing the kernel, because the 4.4.11-v7+ modules have already been removed from Raspbian. If there is no such directory as /lib/modules/4.4.11-v7+ (look) you should run sudo apt update then sudo apt upgrade to ensure your kernel has been ...


6

You likely don't have issues with iptables, unless you installed and configured it as it is not running on a default Raspbian install. Also the default install will normally open and listen on the required ports. However, if you intend on running a mail server you should install and configure a firewall first, as your server will be a prime target for ...


5

You're going to have to change your default routes. route del default route add default gw [WAN gateway/Internet-connected router IP address] [interface] For example: My internet router's IP address is 192.168.1.1 and it's connected to eth1 on the Pi. route del default route add default gw 192.168.1.1 eth1 Don't forget to enable IPV4 (or V6) packet ...


5

The iptables "rules" commands in secure-rmc are very simplistic: logger -t iptables "Configuring ip tables for interface $IFACE" if [ "$IFACE" != "lo" ]; then NETMASK=$(get_subnet $IFACE) iptables -A INPUT -s $NETMASK -i $IFACE -j ACCEPT iptables -A INPUT -i $IFACE -j DROP fi (get_subnet is a function that extracts the subnet of interface $...


5

Right at the top of the raspmc homepage it says: The firewall that we added in the release can now be enabled and disabled via Raspbmc Settings. They claim elsewhere the firewall is iptables and the system is debian based, so if you can't find Settings or it doesn't work, look thru the list returned by service --status-all for "iptables". If it's ...


5

I did some informal testing with a RPi in bridged, routed and NAT configurations using a usb wifi adapter to connect clients to the RPi, and the wired 100 Mbps Ethernet to my Internet router. Connecting directly to the router with wifi, I get 60 Mbps download speeds. With the RPi in the path, it drops to 10 Mbps or less. This was without any iptables ...


5

First, you went about this the wrong way. If you had simply disabled the service (update-rc.d -f dphys-swapfile) instead, it would be much easier to fix. You could also have just added swapoff --all dphys-swapfile swap off To /etc/rc.local. Next, I want you to read this, and if you then are not convinced that the unfounded and absurd concerns about ...


4

You have to initalize your hostapd interface on e.g. wlan0. After that you can bring up your wlan1 and connect it to your router. Now you can bridge wlan0 and wlan1 like this: apt-get install bridge-utils brctl addbr bridge0 brctl addif bridge0 wlan0 brctl addif bridge0 wlan1 ifconfig bridge0 up You can assign an ip to that bridge with: dhclient bridge0 ...


4

Cracked it. TLDR: Use this line: tcpflags = syn instead of this : tcpflags = syn,ack Long story: I found it useful when debugging to run the knockd daemon in interactive mode: sudo service knockd stop sudo knockd -D -v This way the daemon runs in the foreground and prints its configuration and then real-time status messages. I then tried ...


4

iptables -F iptables -X should do the trick of cleaning your current setup, or you may use the particular chain name you don't like: iptables -F INPUT I'd recommend to add these commands at the top of your script issuing iptables commands, so every time you start from a known situation. Also, could you please elaborate more about what is your goal? the ...


4

Your process is listening on IPv6 address ::1 (that's the IPv6 equivalent of IPv4 127.0.0.1 (aka localhost)). You need it to listen on :: (which is IP6ADDR_ANY as that's the IPv6 equivalent of IPv4 INADDR_ANY (0.0.0.0)). Don't use nc -l localhost 5001 If you want to connect from any other machine on your LAN. Use nc -l -p 5001 or nc -l -6 -p 5001 or nc -...


3

Change the vpn configs to both have dev tun and change your iptables to use: *mangle :PREROUTING ACCEPT :INPUT ACCEPT :FORWARD ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT COMMIT *raw :PREROUTING ACCEPT :OUTPUT ACCEPT COMMIT *nat :PREROUTING ACCEPT :INPUT ACCEPT :OUTPUT ACCEPT :POSTROUTING ACCEPT -A POSTROUTING -o tun0 -j MASQUERADE COMMIT *filter :INPUT ...


3

It's not recommended to mess around with a process' affinity. If you really have the urge, use taskset but you have been warned. The best you might do is kill people hurt performance (sic). What I'd recommend is simply fire up multiple instances of OpenVPN, using different configuration files. You'll want to do something along the lines of /usr/local/sbin/...


3

You can make firewall rules like this; iptables --flush iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p icmp --icmp-type 255 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -s 192.168.0.0/24 -d 0/0 -p tcp --dport 80 -j ACCEPT iptables -A INPUT -j REJECT ...


3

If you want a more robust setup, you can try pi-hole. It is an open source software package made to block ads network wide, specifically for a Raspberry Pi. Although it can also run on other platforms. It comes with a management interface and easy updating of the used lists.


3

I've solved the problem. UPDATE: The main issue appears to be in the kernel drivers. Problem solved by upgrading the kernel from 4.14.50-v7+ to the latest stable version (currently 4.14.79-v7+) using sudo apt-get install raspberrypi-kernel, and rebooting. The steps outlined below are no longer necessary. (reference). UPDATE 2: Bad drivers on the client ...


3

It is a bit unclear how do you want to connect the Laptop to the Raspberry Pi. I will assume that there is no other wifi router as access point running for example to connect to the internet so you want to connect to the RasPi direct by wifi. You tagged a bridge so it is possible to bridge the wired interface eth0 to wifi interface wlan0. If you setup the ...


2

I found that this command will give you the IP address only: $ /sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}' To output it to a file: $ /sbin/ifconfig eth0 | grep 'inet addr:' | cut -d: -f2 | awk '{ print $1}' > "/var/www/ipadress.txt"


2

The newer Fedora versions (after 18) use firewalld as a default solution instead of iptables. So all the configuration files are in /etc/firewalld You can read extensively about firewalld configuration options here . Since you effectively want to stop the firewall service just do systemctl stop firewalld.service or to make it permanent systemctl disable ...


2

Goldilocks solution did not work for me. But here is my solution : I added this line to the end of the /etc/network/if-up.d/secure-rmc : sudo /sbin/iptables --flush


2

You may be able to create a network bridge. This essentially lets your Pi act as a network switch between the Wi-fi and wired networks. sudo apt-get install bridge-utils sudo ifconfig eth0 0.0.0.0 sudo ifconfig wlan0 0.0.0.0 sudo brctl addbr br0 sudo brctl addif br0 eth0 sudo brctl addif br0 wlan0 sudo dhclient br0 Note that not all Wi-fi devices will ...


2

As it turns out, I was really close to getting it right. Thanks to the awesome guys over at the raspberry pi forum, I got it working. What I did was changing the gateway on the pi zero to the ip of the pi 2: allow-hotplug usb0 iface usb0 inet static address 10.0.1.2 netmask 255.255.255.0 gateway 10.0.1.1 #<-- I changed this And ...


2

I would like to block all scanners Then disconnect it from the internet. You cannot have it accessible on any port and still hide it from a scanner. The only way to hide it from a scanner and have it online would be to just set: iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP And nothing else. In which case there is no point in ...


2

! is a special bash character for history expansion and has to be escaped. The exclamation mark needs to be escaped in single quotes ' and the position is before the interface name, not before the argument. So your command becomes sudo iptables -t nat -A POSTROUTING -i '!'eth0 -o wlan+ -j MASQUERADE Note that POSTROUTING and -i don't work together, so it ...


2

If you want to make a bridge : http://blog.ithasu.org/2016/10/using-a-raspberry-pi-3-as-a-wifi-access-point-and-bridge/ hotspot : https://github.com/pihomeserver/Kupiki-Hotspot-Script A bridge is transparent. For the hotspot, you fall on a web interface and should use login/password. HotSpot is dedicated for hotel or other public access point. I use the ...


2

Chain INPUT (policy ACCEPT) TARGET: Accept, PROT: tcp, OPT: --, SOURCE: anywhere, DESTINATION: anywhere, tcp dpt: 8092 Chain FORWARD (policy ACCEPT) Chain OUTPUT (policy ACCEPT) As per Steve's first comment, your culprit here is not iptables, meaning there is no firewall configured on your Pi. The default in this case is the three lines above starting with ...


2

Why use iptables at all if you want a ssh reverse tunnel? Use ssh -g -f -N -T -R22222:192.168.1.192:80 user@myvps.com Assuming that 192.168.1.192:80 is the address of your camera and port 22222 is the port to listen on the remote server. No iptables, no forwarding needed for this. You may need to allow the option -g on the server, see sshd_config, set ...


2

I've found a solution and created a script to share it. This script will download a list of known domains and block them by using dnsmasq. Those lists will be updated daily. Run ./adblocker.sh --install|--start|--stop to install, start or stop it. The script: #!/bin/bash installAB () { if [[ "$(crontab -l | grep adblocker.sh)" =~ adblocker.sh ]]; then ...


1

Check SSH Make sure that your ssh server is running properly. Connect to your Pi with a keyboard, mouse and monitor (or other) Check your Pi's ip address ip a Check that ssh is running sudo systemctl status sshd.service or sudo /etc/init.d/ssh status Check that iptables is not blocking ssh traffic iptables-save (no output is a good sign). Undo The Changes ...


1

You want to use "DNAT" for this. You do DNAT in the PREROUTING nat table. Probablly something along the lines of iptables -t nat -A PREROUTING -i tun0 -j DNAT --to-destination <destination ip>


Only top voted, non community-wiki answers of a minimum length are eligible